{"id":"CVE-2026-58052","title":"7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a R…","summary":"7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a R…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-693"],"vendor":"7-zip","product":"7-zip","affected":["7-zip <= 26.01"],"published":"2026-06-28","updated":"2026-08-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58052","references":[{"url":"https://github.com/bikini/exploitarium/tree/main/7zip-rar5-motw-chain-poc","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ip7z/7zip","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/7-zip-mark-of-the-web-bypass-via-rar5-alternate-data-stream-name-collision","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00171,"epssPercentile":0.06849,"ingestedAt":"2026-08-07T21:17:17.927Z","slug":"CVE-2026-58052","body":"## Overview\n\n7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.\n\n## Affected\n\n- `7-zip <= 26.01`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}